{"record":{"id":"abb28689656b970c","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-abb286","errorCode":"error-action-not-allowed","errorMessage":"Changing email is not allowed","messagePattern":"Changing email is not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/setEmail.ts","lineNumber":22,"sourceCode":"import { Meteor } from 'meteor/meteor';\n\nimport { RateLimiterClass as RateLimiter } from '../../lib/RateLimiter';\nimport { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';\nimport { setEmail } from '../../lib/users/setEmail';\nimport { settings } from '../../settings';\n\ndeclare module '@rocket.chat/ddp-client' {\n\t// eslint-disable-next-line @typescript-eslint/naming-convention\n\tinterface ServerMethods {\n\t\tsetEmail(email: string): string;\n\t}\n}\n\nexport const setEmailFunction = async (email: string, user: Meteor.User | IUser) => {\n\tcheck(email, String);\n\n\tif (!settings.get('Accounts_AllowEmailChange')) {\n\t\tthrow new Meteor.Error('error-action-not-allowed', 'Changing email is not allowed', {\n\t\t\tmethod: 'setEmail',\n\t\t\taction: 'Changing_email',\n\t\t});\n\t}\n\n\tif (user.emails?.[0]?.address === email) {\n\t\treturn email;\n\t}\n\n\tif (!(await setEmail(user._id, email))) {\n\t\tthrow new Meteor.Error('error-could-not-change-email', 'Could not change email', {\n\t\t\tmethod: 'setEmail',\n\t\t});\n\t}\n\n\treturn email;\n};\n","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/setEmail.ts#L4-L40","documentation":"setEmailFunction refuses any email change when the workspace setting Accounts_AllowEmailChange is false. The check runs first - before the same-address early-return - so even resubmitting the user's current email throws while the setting is off.","triggerScenarios":"saveUserProfile (which delegates to setEmailFunction when settings.email is set) or setEmail itself, called with any email value while Accounts_AllowEmailChange is disabled under Administration > Accounts.","commonSituations":"Fresh installs where email change is off by default; LDAP/OAuth-managed workspaces that intentionally lock email addresses; a profile UI that still shows an editable email field although the server forbids changes.","solutions":["Enable Accounts_AllowEmailChange (Administration -> Accounts -> Email Change) if self-service email change is intended","Hide or disable the email field in the UI when the setting is false (it ships in the client's public settings)","For supported programmatic flows prefer the REST endpoint /v1/users.updateOwnBasicInfo or admin /v1/users.update"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const allowEmailChange = publicSettings['Accounts_AllowEmailChange'] === true;\nif (!allowEmailChange) {\n  disableField('email'); // do not even include email in the payload\n}","typeGuard":null,"tryCatchPattern":"catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-action-not-allowed' && err.details?.action === 'Changing_email') {\n    showNotice('Email change is disabled on this server');\n  }\n}","preventionTips":["Read Accounts_AllowEmailChange from public settings and hide the email field when false","Remember the setting is checked before the same-email short-circuit - resubmitting an unchanged email still throws","For managed flows use /v1/users.updateOwnBasicInfo or admin users.update"],"tags":["meteor","email","settings","account"],"backgroundTag":"feature-disabled-by-setting","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}